Fix secret permissions

[perso/Immae/Config/Nix.git] / nixops / modules / websites / piedsjaloux / piedsjaloux.nix

diff --git a/nixops/modules/websites/piedsjaloux/piedsjaloux.nix b/nixops/modules/websites/piedsjaloux/piedsjaloux.nix
index 4caf48a701ba5dff1de1d46a9f1025c85c368ab4..1c7e983f72eaa6679d4e10c4d1bd91dd7cb8189d 100644 (file)
--- a/nixops/modules/websites/piedsjaloux/piedsjaloux.nix
+++ b/nixops/modules/websites/piedsjaloux/piedsjaloux.nix
@@ -3,8 +3,12 @@ let
   piedsjaloux = { config }: rec {
     environment = config.environment;
     varDir = "/var/lib/piedsjaloux_${environment}";
-    configRoot =
-      writeText "parameters.yml" ''
+    keys."${environment}-piedsjaloux" = {
+      destDir = "/run/keys/webapps";
+      user = apache.user;
+      group = apache.group;
+      permissions = "0400";
+      text = ''
         # This file is auto-generated during the composer install
         parameters:
             database_host: ${config.mysql.host}
@@ -22,7 +26,9 @@ let
         leapt_im:
             binary_path: ${imagemagick}/bin
       '';
+    };
     phpFpm = rec {
+      serviceDeps = [ "mysql.service" "${environment}-piedsjaloux-key.service" ];
       socket = "/var/run/phpfpm/piedsjaloux-${environment}.sock";
       pool = ''
         listen = ${socket}
@@ -33,7 +39,7 @@ let
         php_admin_value[upload_max_filesize] = 20M
         php_admin_value[post_max_size] = 20M
         ;php_admin_flag[log_errors] = on
-        php_admin_value[open_basedir] = "${configRoot}:${webappDir}:${varDir}:/tmp"
+        php_admin_value[open_basedir] = "/run/keys/webapps/${environment}-piedsjaloux:${webappDir}:${varDir}:/tmp"
         php_admin_value[session.save_path] = "${varDir}/phpSessions"
         env[PATH] = ${lib.makeBinPath [ pkgs.apg pkgs.unzip ]}
         ${if environment == "dev" then ''
@@ -146,9 +152,9 @@ let
         postInstall = ''
           cd $out
           rm app/config/parameters.yml
-          ln -sf ${configRoot} app/config/parameters.yml
+          ln -sf /run/keys/webapps/${environment}-piedsjaloux app/config/parameters.yml
           rm -rf var/{logs,cache,data,miniatures,tmp}
-          ln -sf ../../../../../../../${varDir}/{logs,cache,data,miniatures,tmp} var/
+          ln -sf ${varDir}/{logs,cache,data,miniatures,tmp} var/
           '';
       });
     webRoot = "${webappDir}/web";